Description
Scribus before 1.6.7 contains a heap out-of-bounds write vulnerability in the scimgdataloader_psd loader that uses unchecked PSD file values as lookup array indexes. Attackers can convince users to place or import a crafted PSD file to corrupt heap memory, causing crashes and potentially code execution as the user.
Published: 2026-10-30
Score: 8.5 High
EPSS: n/a
KEV: No
Impact: Code Execution via Heap Corruption
Action: Immediate Patch
AI Analysis

Impact

Scribus’s PSD image loader contains an unchecked array index that uses values from an incoming PSD file to access a heap array without bounds validation. This heap out‑of‑bounds write corrupts adjacent heap memory, potentially leading to application crashes or the attacker’s code executing as the user. The weakness is classified as unchecked array indexing (CWE‑787).

Affected Systems

All Scribus installations earlier than version 1.6.7 are affected. The issue is resolved in Scribus 1.6.7 and later releases. No other vendors or product variants are currently listed as impacted.

Risk and Exploitability

The vulnerability has a CVSS score of 8.5, indicating high severity. The EPSS score is not available and the issue is not in CISA’s KEV catalog. Because the flaw requires a crafted PSD file that a user must open, the likely attack vector is local or via social engineering. Successful exploitation could corrupt heap memory, causing a crash or enabling arbitrary code execution with the victim’s privileges.

Generated by OpenCVE AI on October 30, 2026 at 16:14 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Upgrade Scribus to version 1.6.7 or later to eliminate the flaw.
  • If an upgrade is not immediately possible, restrict or disable the ability to import or open PSD files from untrusted sources.
  • Apply any vendor‑provided patches or work‑arounds as soon as they become available.

Generated by OpenCVE AI on October 30, 2026 at 16:14 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Fri, 30 Oct 2026 15:30:00 +0000

Type Values Removed Values Added
Description Scribus before 1.6.7 contains a heap out-of-bounds write vulnerability in the scimgdataloader_psd loader that uses unchecked PSD file values as lookup array indexes. Attackers can convince users to place or import a crafted PSD file to corrupt heap memory, causing crashes and potentially code execution as the user.
Title Scribus before 1.6.7 Heap Out-of-Bounds Write via PSD Image Loader
Weaknesses CWE-787
References
Metrics cvssV3_1

{'score': 7.8, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H'}

cvssV4_0

{'score': 8.5, 'vector': 'CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N'}

Subscriptions

No data.

cve-icon MITRE

Status: PUBLISHED

Assigner: VulnCheck

Published:

Updated: 2026-10-30T15:15:56.127Z

Reserved: 2026-10-01T18:02:50.081Z

Link: CVE-2026-104061

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Received

Published: 2026-10-30T16:17:35.250

Modified: 2026-10-30T16:17:35.250

Link: CVE-2026-104061

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-10-30T16:15:14Z

Weaknesses